Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates container_cluster to set enable_legacy_abac to false by default #1281

Merged
merged 5 commits into from
Apr 4, 2018
Merged

Updates container_cluster to set enable_legacy_abac to false by default #1281

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
60c0774
Updates the default GKE legacy ABAC setting to false
mrparkers Apr 1, 2018
56bc1d7
Updates docs for container_cluster
mrparkers Apr 1, 2018
db681e2
Update test comments
mrparkers Apr 1, 2018
0584307
Format fix
mrparkers Apr 1, 2018
a067d4e
Adds ImportState test step to default legacy ABAC test
mrparkers Apr 4, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion google/resource_container_cluster.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -206,7 +206,7 @@ func resourceContainerCluster() *schema.Resource {
"enable_legacy_abac": {
Type: schema.TypeBool,
Optional: true,
Default: true,
Default: false,
},

"initial_node_count": {
Expand Down
38 changes: 38 additions & 0 deletions google/resource_container_cluster_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -368,6 +368,35 @@ func TestAccContainerCluster_withLegacyAbac(t *testing.T) {
})
}

/*
Since GKE disables legacy ABAC by default in Kubernetes version 1.8+, and the default Kubernetes
version for GKE is also 1.8+, this test will ensure that legacy ABAC is disabled by default to be
more consistent with default settings in the Cloud Console
*/
func TestAccContainerCluster_withDefaultLegacyAbac(t *testing.T) {
t.Parallel()

resource.Test(t, resource.TestCase{
PreCheck: func() { testAccPreCheck(t) },
Providers: testAccProviders,
CheckDestroy: testAccCheckContainerClusterDestroy,
Steps: []resource.TestStep{
{
Config: testAccContainerCluster_defaultLegacyAbac(acctest.RandString(10)),
Check: resource.ComposeTestCheckFunc(
resource.TestCheckResourceAttr("google_container_cluster.default_legacy_abac", "enable_legacy_abac", "false"),
),
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Mind adding an import step here as well? (Take a look at the other tests in this file for examples)

},
{
ResourceName: "google_container_cluster.default_legacy_abac",
ImportStateIdPrefix: "us-central1-a/",
ImportState: true,
ImportStateVerify: true,
},
},
})
}

func TestAccContainerCluster_withVersion(t *testing.T) {
t.Parallel()

Expand Down Expand Up @@ -1314,6 +1343,15 @@ resource "google_container_cluster" "with_kubernetes_alpha" {
}`, clusterName)
}

func testAccContainerCluster_defaultLegacyAbac(clusterName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "default_legacy_abac" {
name = "cluster-test-%s"
zone = "us-central1-a"
initial_node_count = 1
}`, clusterName)
}

func testAccContainerCluster_withLegacyAbac(clusterName string) string {
return fmt.Sprintf(`
resource "google_container_cluster" "with_legacy_abac" {
Expand Down
2 changes: 1 addition & 1 deletion website/docs/r/container_cluster.html.markdown
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,7 @@ output "cluster_ca_certificate" {
* `enable_legacy_abac` - (Optional) Whether the ABAC authorizer is enabled for this cluster.
When enabled, identities in the system, including service accounts, nodes, and controllers,
will have statically granted permissions beyond those provided by the RBAC configuration or IAM.
Defaults to `true`
Defaults to `false`

* `initial_node_count` - (Optional) The number of nodes to create in this
cluster (not including the Kubernetes master). Must be set if `node_pool` is not set.
Expand Down